convex-security-check

Security audit checklist for Convex applications covering authentication, exposure, validation, and access control. A quick security audit checklist for Convex applications covering authentication, function exposure, argument validation, row-level access control, and environment variable handling. Before implementing, do not assume; fetch the latest documentation: Use this checklist to quickly audit your Convex application's security: - Five-part checklist covering authentication provider setup, function exposure (public vs. internal), argument validation strictness, row-level access control, and environment variable handling - Includes TypeScript code examples for secure patterns: authentication helpers, ownership verification before updates/deletes, and strict argument validators - Highlights common pitfalls like missing identity checks, exposed internal operations, and use of v.any() for sensitive data - Provides helper functions ( requireAuth , requireAdmin ) and complete security pattern examples for immediate implementation - Primary: - Production Security: - Functions Auth: - For broader context: - Never run npx convex deploy unless explicitly instructed - Never run any git commands unless explicitly instructed - Always verify user identity before returning sensitive data - Use internal functions for sensitive operations - Validate all arguments with strict validators -...